The present invention relates to screening of data packets sent from one computer network to another. There are numerous ways for a user on a public network to interact with a host machine on a private network, such as in a telnet session, an ftp (file transfer protocol) session, by email (electronic mail), and so on. In addition, computers on a given target network may be requested to carry out certain operations by users outside the network, besides directly connecting the requester's machine.
A conventional internet work 10 is shown in FIG. 1, including a private network 20, a public network 30, and another private network 40. If the private networks 20 and 40 are not provided with firewalls, they are quite vulnerable to intruders.
FIG. 3 shows an internet work 110 where a private network 120 can communicate with another private network 140 via a router or bridge 120, which is controlled by logic (such as a circuit, or typically a processor with associated memory) 150 which controls network interfaces 160 and 170. When a data packet arrives from network 140 addressed to a host and specifying a port on network 120, it is mapped to that host and port by unit 180, and transmitted via interface 160 to the appropriate destination on the network 120. FIG. 3 is also not provided with any security, and hence is available for targeting.
Computer firewalls have therefore been developed, as in the system 50 shown in FIG. 2, where private networks 60 and 100 can communicate with one another via public network 80, but are provided with firewalls 70 and 90, respectively. A problem with conventional computer firewalls (and routers or bridges such as bridge 130 in FIG. 3) in use today is that they participate in IP (Internet Protocol) transactions, and in doing so generate information identifying them as IP machines, which makes them visible for targeting by intruders. For a detailed discussion of this and other types of problems with firewalls, see, e.g. the reference Firewalls and Internet Security by Cheswick & Bellovin (Addison Wesley 1994), and Internet Firewalls and Network Security by Siyan & Hare (New Riders Publishing 1995), which are incorporated herein by reference.
A firewall and packet filtering system should ideally be invisible to intruders so as to help minimize the number of ways in which it can be targeted, while nonetheless filling functions that are appropriate.
Current network security solutions often involve modifications to the networks in addition to the provision of firewalls, which can be complicated and expensive. A system is needed that can be connected to a network substantially without altering it, but providing security against breaches from outside the protected network.
Packet filtering systems are used today to provide security for networks, but conventionally act as routers, having one port or network interface coupled to the protected network and another port to another network or the Internet. As routers, such systems are responsive to IP commands, and in particular may respond to data packets by using their IP addresses. This allows intruders to target them for characterization and attack.
The same type of targeting may be accomplished when addresses within a protected network are known to users outside the network. It would therefore by advantageous to provide a system that can respond to data packets from outside a network without revealing IP address information about either the filtering system or about hosts within the network.